Posted
by
CmdrTaco
on Monday December 22, 2008 @12:15PM
from the welcome-to-the-holidays dept.

narramissic writes "The National Security Agency has patented a technique for figuring out whether someone is messing with your network by measuring the amount of time it takes to send different types of data and sounding an alert if something takes too long. 'The neat thing about this particular patent is that they look at the differences between the network layers,' said Tadayoshi Kohno, an assistant professor of computer science at the University of Washington. But IOActive security researcher Dan Kaminsky wasn't so impressed: 'Think of it as — if your network gets a little slower, maybe a bad guy has physically inserted a device that is intercepting and retransmitting packets. Sure, that's possible. Or perhaps you're routing through a slower path for one of a billion reasons.'"

They can allow you to sue by laws passed previously. There are also some constitutional provisions on this. They wouldn't be able to back out of it. So in this case at least, unless the law that allows someone to sue for patent infringement specifically exempted the US government and it's agencies or entities, then you would already have permission to sue.

There is a constitutional problem here too. The constitution says no property can be taken without due process of the law or just comp

The NSA has the ability to file for a patent from the U.S. Patent and Trademark Office under gag order. Unlike normal patents, these are not revealed to the public and do not expire. However, if the Patent Office receives an application for an identical patent from a third party, they will reveal the NSA's patent and officially grant it to the NSA for the full term on that date.

ummm... if someone else creates an identical patent, doesn't that mean that it is obvious to someone who works in the field? A person having ordinary skill in the art is able to find the same way of solving the problem.

Not really, they'd be notified if the patent infringed upon the previous NSA patent. Unfortunately due to the many overly broad patents out there, you might just be patenting something in the same general field.

Two people/companies eventually coming to a solution that is sufficiently similar to violate patents is a long way from "obvious to someone who works in the field". And, assuming that the two people who identified the solution are the leaders in their field (because they reached the idea before the other 6.7 billion of us), they could be described as having "extraordinary skill in the art".

There are a number of patents for designs that multiple developers reached independently and were awarded to the person who managed to file first (Edison seemed to have extraordinary luck in beating his competitors to the patent office). That doesn't necessarily make the solution obvious, just non-unique.

The way patents work is even if all of us 6.7 million run to the patent office, because we all had the same idea, the first would still get it (or Edison if he were still alive).

Well, if the law doesn't spare the "2nd" inventor the need to pay the patent license, I'd say fuck the patent system. The patent system was introduced so original inventors were encouraged to publicize their invention in an orderly fashion, enabling others (the licensees) to build upon that and achieve quicker innovation cycles themselves, while the original inventor also benefits because he gets to collect the license fees. In the end, the overall rate of innovation would increase and society as a whole sh

I'd love to see this go to court. At no point does the government have a right to have its own intellectual property, and protection. (This does not include "classified information" which does not fall under "intellectual property" laws.)

IIRC, any signicantly important patent can be issued secretly. If you apply for a patent on "an individualized (based on dental records) death beam from space" the DoD gets to look at it, and can ask that you get the same treatment.

However, if the Patent Office receives an application for an identical patent from a third party, they will reveal the NSA's patent and officially grant it to the NSA for the full term on that date.

If the Patent Office receives an application for an identical patent, I doubt the disclosure will ever happen. Far more likely the NSA will just have the applicant arrested for using "stolen" "national security secrets."

It is much more likely that the patent office will simply deny the application with some bogus un-patentable mark and cite some prior art leading to an obviousness issue.

If the applicant makes a fuss about it, they will just warn them of the deal, instruct them that they can't talk about it. If the guy tries to goto court over it, the NSA just shows the judge their patent, tells him about the secret nature of it, and the judge dismisses the case for lack of standing or something.

Seriously, do you know how hard it is to keep a secret in government? The scale of the scam would simply be too big to orchestrate without someone bragging about it or trying to get revenge or something. Besides, the Government doesn't need a patent license for anything, all they need to do is determine what is a "just compensation" and just use it, then pay you what they think is "just". Actually, most governments have that ability and it's even supported by international la

From what I gather, you can apply for licenses to federally-owned patents. This is typically done through a "Technology Transfer" office. It seems that you have to be a business capable of bringing the invention to market. I suppose in this case you would have to be capable of implementing the software.

It's actually easier even than that. I'm overseeing a DoE lab team that's been working for about a year to develop a new tool that our customer needs to use but does not exist. We have no desire to actually manufacture anything so we've been seeking out partners in industry all along the way to build the pieces for the prototypes. So, once we're finished, the industry folks will be responsible for building our units along with as many as they see fit to bring to market. The actual patents will sit with

to a network that didn't have one before would. And yes, the delay is noticeable, which is why proper network design limits the number of hubs as well as the length of the longest run in a single network segment.

Use a tap instead of a hub. It's a non-repeater, no electronics; rig the TX pair in one direction to RX for one NIC, and the RX pair in the same direction to the RX for a second NIC. Both pairs also go to the output port. Plug input into one jack, output into another, hook your snooper into both.

As long as it's not supposed to be a straight link from one end to the other? Also I assumed they would had wanted to use it for detection changes in data, because if someone snaps it up and then sends out some changed data it will indeed be noticed, right?

one primary reason the government patents things is to protect themselves from paying licenses/royalties later for things they've already funded. I.e., most contracts stipulate that if the government funded a development that was patented, even by contractor, the government retains royalty free usage of the invention. Similarly, if they patent something they invented, it guarantees no one can 'invent' it later and charge for use (a CYA patent). Of course, the government can collect royalties on patented in

I'd expect that it's been infested with middle management idiot-cousin fuckknuckles who attempt to justify their pitiful existence by proactively leveraging synergies to facilitate win win scenarios across all core competencies.

Presumably the NSA's owners (the USian taxpayers) will get a good return on their investment.

there is SO much randomness in a network (ethernet is BUILT on the whole notion of 'randomness adds to efficiency' (csma/cd uses randomness to 'increase order' in a network) that this can't possibly do much.

it WOULD be a nice random number generator. take your 'output' and send it to something that generates heat, measure the heat and then do math on that.

that might work.

but this 'scheme' to detect active listeners? what a laugh. networks are simply

Seems very anti-internet protocol. Internet protocol was designed route dynamically. Basically this only detects something if something is not going through a known route. Averages must be taken from every known route or the alarm will go off all the time, so in a lot of cases it's not very practical. New routes are added all the time. All these points become moot when you start using encryption like you're suppose to.

Dan Kaminsky is a smart guy but he seems to have missed the ball on this one. The idea behind the invention is that more complex inline packet sniffers are effectively layer 3 or above switches and as such will introduce different delays for different types of traffic depending on the attacker's interests. For example, ICMP typically won't interest an attacker so the packets will get forwarded promptly. UDP and/or TCP/IP laden with VOIP or file data would require the eavesdropping switch to further process

This is another example of the broken patent system. No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.

I was actually confused by that when I first saw the headline. I didn't even know that the government could patent something. It's just so completely broken and silly that I never even considered it.

There are many reasons why this is possible. First of all, the Government agencies all can patent processes/things and they have to follow the same rules as anyone else. One reason you want to provide this capability is to prevent Company A from developing said technology only to turn around and sell it to Country B.

The fact that it can be patented could be a good thing in the broken system. It could or should be that when the government patents it, everybody can use it. That way no company can claim the patent as their own.

However patents are used not to protect ideas as it is to create a scarcity to drive the price up.

This is another example of the broken patent system. No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.

I killed my spent mod points to respond to this. I have no problems with the gov't patenting something, just as long as they don't use it to prevent people from using it in a positive manner. It's possible the gov't patented this so they could share the information with other people and not worry about some private company patenting the idea and then sueing everyone else for us it. Basically - patent to allow people to use it. In this case we don't have to look at the gov't for being evil, but maybe the gov't is protecting us from companies who like to create submarine patents?

Instead of looking at everything the gov't does and say "but it's evil because big brother did it", let's give them the benefit of the doubt.

It's possible the gov't patented this so they could share the information with other people and not worry about some private company patenting the idea and then sueing everyone else for us it. Basically - patent to allow people to use it.

If that's the intent, and the patent system is working as intended, then the patenting is superfluous. Publication of all the details (without restriction) is sufficient to prevent anyone else from patenting the idea, because the publication acts as demonstrable prior art with which to challenge any subsequent patent application. (This is also why anyone who wants to patent something usually has to hold off on publication until the patent process is already underway--a publication can be used to show that t

Of course, in reality publishing details is usually not enough to prevent someone else from patenting, because it seems that no one (least of all patent examiners) does a thorough job of uncovering prior art.

Patent examiners basically search issued patents and published patent applications. If you want to challenge a pending application based on prior art, here is the:

POOR MAN'S CHALLENGE TO A PENDING PATENT APPLICATION.

Make a copy of the reference you think anticipates the patent. Send a copy to the appl

Instead of looking at everything the gov't does and say "but it's evil because big brother did it", let's give them the benefit of the doubt.

Giving them the benefit of the doubt is how we got the Iraq War, Banking Deregulation, Trickle Down Economics, "Good Job Brownie", and etc, etc. The Government should always have to demonstrate that what they're doing is beneficial and not just "trust us."

Giving them the benefit of the doubt is how we got the Iraq War, Banking Deregulation, Trickle Down Economics, "Good Job Brownie", and etc, etc. The Government should always have to demonstrate that what they're doing is beneficial and not just "trust us."

And thats why we have elections. BTW naming all the bad the gov't does and not listing any of the good does not make your comments valid. If the gov't only did bad, well we know what happend the last time we got really pissed at our gov't.

I don't know what GP was referring to but why is referring to the american revolution a chuckle in this context?Because you don't see it happen? Well, then doesn't that prove his point that the government apparently does some things right?

is laughable at this point. . . the last REAL insurrection was the Civil War and it was put down with extreme prejudice. Expect the same for more, which is why the whole idea of threatening revolution is amusing.

Well, GP didn't talk about a threat, maybe check your reading comprehension?In fact, GP argued that the lack of tendencies towards a revolution in our spoiled society indicates that the government can't be *that* bad after all.

If the gov't only did bad, well we know what happend the last time we got really pissed at our gov't.

My point was the last few times the gov't did really bad (Civil War the most notable) the revolt was shut down with extreme prejudice by said government. Arguing that "since we haven't had a revolution in a while it can't be all bad" is a little amusing, don't you think?

Nah, don't really think so.The thing about revolutions (in the civil war sense) is that they usually happen despite (or even because) prior attempts have been shutdown violently. It takes quite a bit of pressure and wrongdoing to drive a society into violent resistance. The US is obviously nowhere near that point, I still don't see what's so amusing about his statement anyways...

It's possible the gov't patented this so they could share the information with other people and not worry about some private company patenting the idea and then sueing everyone else for us it. Basically - patent to allow people to use it.

This is another example of the broken patent system. No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.

I fully agree, but at the same time, it also prevents some company to claim that it has the copyright of something that belongs to the "people".

But I agree with you, on the principle that the government has to waste resources to search and file a patent. Unless there is some standing order from higher up for government organizations to patent everything to block private patents of it. There appears to be no justification in the authorization of any funds to be used for paying patent lawyers or filing with the patent office.

Once you pay the government, it stops becoming your money. You don't in any way own the road I drive on just because you pay your taxes. You may get some privileges to use it, but really, not even that. I mean, when they close the road I've never successfully gotten out of my car, showed them a 1099 tax form and forced them to let me drive on MY road...

No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.

Actually, I'd be happy to let 'em patent stuff on one condition: that all monies from said patent licensing goes directly to pay our taxes. Not a fund to be raided like Social Security, but one SOLELY for taxpayer relief.

No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.

I know. I went to a military base and said I wanted to fly an F-22 for a while. It seems easy and a lot of fun. When they gave me trouble, I tried explaining that the F-22 was funded by the taxpayer (me) and thus I just wanted to get my share of its use.

these false positives really begin to add up. Couple this will all the lame-brained terrorist detection schemes that create millions of false positives and we can see the plan to get America out of recession is to have every single citizen working for the government hunting snipe.

It is not just measuring speed of network it is apparently measure differences in speeds of different network layers, or types of network traffic. Network congestion affects generally all types of packets the same. Snooping presumably may take longer to identify certain types of packets.Oh and a passive tap will only work with certain protocols, it can't work (or not easily) with Gigabit ethernet for example.

The best this will be able to do is detect changes in latency patterns, possibly being able to narrow it down to certain network segments depending on how many devices are having their details analysed in real time.

"NSAapp: Latency change detected in segment AA23. No idea what it might mean. Send the intern."

Uh well that is some very valuable information, especially when deciding if you should actually send some information or not.

If you are aware the link has a 99% confidence level that it isn't being snooped on or a 75% confidence level you may greatly alter what information, however encrypted, secure, timely, or whatever its attributes. Some simple historical sampling of trends with some "intelligent" sorting on top would allow you to assign many different confidence levels to individual connections.

This also strikes me as similar to how HDMI works. The output and input devices are in constant communication with each other, so if a device inserted in between is attempting to decode the data the video stream is effectively shut off.

I don't think it's of any use to the average home user or small business. Too much weird stuff can happen on a run of the mill network. But, if you're someone like the NSA where every device is scrutinized closely and the network itself is managed tightly, an unexpected slow down at some layer of some stream of network traffic could be useful in finding a snoop... at the very least, it'll highlight potential bottlenecks in the network.

Dan Kaminsky's Blackhat US 2006 and 2007 talks (as I recall) metioned using techniques similar to this to detect protocol based bandwidth throttling, and used it to detect P2P traffic shaping. I would personlly say that this would work to detect a layer 2 man in the middle attack using something like ettercap. Or as Dan said, to detect some kind of inline intercept box on the network. In order to do that, you'd need to hoave a pretty good idea what the latency nubers should be to start with. In my exper

Because they are going to drop all their other methods of intrusion detection for this? It seems like a reasonable cue for a warning for something that is difficult to pinpoint. Especially if that warning were to kick off an automated task that kicked off a more intensive search/monitoring process.

i remember a while back a firend of mine that workd for a college was tasked with trying to find a person who was sniffing peoples logins on the campus wifi.. what he ended up doing was sending out garbled truncated packets - turns out that windows boxes running things like etheral would get the truncated packet and then request the rest of the packet even though it wasn't addressed to them.. very clever way of finding the stupid ones.. luckly the person they where after was stupid

This may be ugly, but I have used a tricked out ethernet cable that has only receive wires to sniff packets.

I don't see how a sniffer that can't transmit would in any way be detected. So long as it does not attenuate the signal so much that packets are being lost routinely (in the particular circumstances in which I used this cable, this was not apparently the case)

I think when people talk of snooping on traffic they are probably thinking of a passive receive-only device.